Ofcom’s failure to include a measure on user identity verification is a significant example of a flawed, overly timid approach.